Securing communication between the hub server and a spoke server

To secure communications between the hub server and a spoke server by using the Transport Layer Security (TLS) protocol, you must define the certificate of the spoke server to the hub server, and the certificate of the hub server to the spoke server. You must also configure the Operations Center to monitor the spoke server.

1. Complete the following steps to define the certificate of the spoke server to the hub server:
   1. On the spoke server, change to the directory of the spoke server instance.
   2. Verify the certificates in the key database file of the spoke server. Issue the following command:

      gsk8capicmd_64 -cert -list -db cert.kdb -stashed 

   3. Securely transfer the cert256.arm file of the spoke server to the hub server.
   4. On the hub server, change to the directory of the hub server instance.
   5. Define the spoke server certificate to the hub server. Issue the following command from the hub server instance directory, where spoke_servername is the name of the spoke server, and spoke_cert256.arm is the file name of the spoke server certificate:

      gsk8capicmd_64 -cert -add -db cert.kdb -stashed -format ascii -trust enable
       -label spoke_servername -file spoke_cert256.arm

2. Complete the following steps to define the certificate of the hub server to the spoke server:
   1. On the hub server, change to the directory of the hub server instance.
   2. Verify the certificates in the key database file of the spoke server. Issue the following command:

      gsk8capicmd_64 -cert -list -db cert.kdb -stashed 

   3. Securely transfer the cert256.arm file of the hub server to the spoke server.
   4. On the spoke server, change to the directory of the spoke server instance.
   5. Define the hub server certificate to the spoke server. Issue the following command from the spoke server instance directory, where hub_servername is the name of the hub server, and hub_cert256.arm is the file name of the hub server certificate:

      gsk8capicmd_64 -cert -add -db cert.kdb -stashed -format ascii -trust enable
       -label hub_servername -file hub_cert256.arm

3. Restart the hub server and the spoke server.
4. Complete the following steps to define the spoke server to the hub server, and the hub server to the spoke server.
   1. Issue the following commands on both the hub server and the spoke server:

      SET SERVERPASSWORD server_password
      SET SERVERHLADDRESS ip_address
      SET SERVERLLADDRESS tcp_port

   2. On the hub server, issue the DEFINE SERVER command, according to the following example:

      DEFINE SERVER spoke_servername HLA=spoke_address
       LLA=spoke_SSLTCPADMINPort SERVERPA=spoke_serverpassword

   3. On the spoke server, issue the DEFINE SERVER command, according to the following example:

      DEFINE SERVER hub_servername HLA=hub_address
       LLA=hub_SSLTCPADMINPort SERVERPA=hub_serverpassword

      Tip: By default, server communication is encrypted except when the server is sending or receiving object data. Object data is sent and received by using TCP/IP. By choosing not to encrypt the object data, server performance is similar to communication over a TCP/IP session and the session is secure. To encrypt all communication with the specified server, even when the server is sending and receiving object data, specify the SSL=YES parameter on the DEFINE SERVER command.
5. Complete the following steps to configure the Operations Center to monitor the spoke server:
   1. On the Operations Center menu bar, click Servers.
      The spoke server has a status of "Unmonitored." This status means that, although this server was defined to the hub server by using the DEFINE SERVER command, the server is not yet configured as a spoke.
   2. Click the spoke server to highlight the item, and click Monitor Spoke.